paramter algorithms will be required in the future

privacyidea/api/auth.py

@@ -293,7 +293,7 @@ def get_auth_token():
                         "authtype": authtype,
                         "exp": datetime.utcnow() + validity,
                         "rights": rights},
-                       secret)
+                       secret, algorithm='HS256')
 
     # Add the role to the response, so that the WebUI can make decisions
     # based on this (only show selfservice, not the admin part)

privacyidea/api/lib/prepolicy.py

@@ -1113,7 +1113,7 @@ def api_key_required(request=None, action=None):
         if not auth_token:
             auth_token = request.headers.get('Authorization')
         try:
-            r = jwt.decode(auth_token, current_app.secret_key)
+            r = jwt.decode(auth_token, current_app.secret_key, algorithms=['HS256'])
             g.logged_in_user = {"username": r.get("username", ""),
                                 "realm": r.get("realm", ""),
                                 "role": r.get("role", "")}

privacyidea/api/lib/utils.py

@@ -280,7 +280,7 @@ def verify_auth_token(auth_token, required_role=None):
         raise AuthError(_("Authentication failure. Missing Authorization header."),
                         id=ERROR.AUTHENTICATE_AUTH_HEADER)
     try:
-        r = jwt.decode(auth_token, current_app.secret_key)
+        r = jwt.decode(auth_token, current_app.secret_key, algorithms=['HS256'])
     except jwt.DecodeError as err:
         raise AuthError(_("Authentication failure. Error during decoding your token: {0!s}").format(err),
                         id=ERROR.AUTHENTICATE_DECODING_ERROR)